Make the QA group scan the StaticArrays extension

[ChrisRackauckas-Claude]

Why

SciMLTesting.run_qa runs ExplicitImports' checks on the package module.
ExplicitImports does know about extensions — it reads the [extensions] table
out of Project.toml and adds each one to the set of checked modules — but only
if the extension module actually exists:

ext_mod = Base.get_extension(mod, Symbol(ext))
ext_mod === nothing && continue

An extension module only exists once its trigger weakdep has been loaded. The QA
environment loaded no weakdeps, so ExponentialUtilitiesStaticArraysExt was
never scanned by QA at all.

What changed

• test/qa/Project.toml: added StaticArrays (same UUID as the root
  [weakdeps] entry) with a [compat] bound mirroring the root 1.9.8.
• test/qa/qa.jl: using StaticArrays before run_qa, with a comment
  explaining that this is what makes the extension visible to ExplicitImports.

Coverage: StaticArrays is the package's only weakdep, so this brings
extension coverage from 0/1 to 1/1. Nothing is left unscanned.

Findings from the newly-scanned extension, and how each was handled

Turning the scan on produced two failures.

Fixed at the source (not ignored) — no_implicit_imports: the extension did
using StaticArrays and then referred to StaticArrays.arithmetic_closure,
SMatrix and SVector implicitly. Changed to
using StaticArrays: StaticArrays, SMatrix, SVector. No behavior change; the
all_explicit_imports_via_owners check is satisfied by this spelling.

Ignored with justification — all_qualified_accesses_are_public:
StaticArrays.arithmetic_closure. This is the only spelling of "the type you get
from doing arithmetic on this eltype", which the extension needs in order to pick
the working eltype for expv on an integer-valued SMatrix. It is documented by
StaticArrays — its own docstring demonstrates
import StaticArrays.arithmetic_closure — but StaticArrays has never exported
it or declared it public, and there is no public equivalent. Added to the
existing all_qualified_accesses_are_public ignore tuple with a comment naming
the owner and the reason, matching the style already in the file.

No check was disabled, no @test_broken was added, and no ignore was used where
a source fix was available.

Local verification

GROUP=QA julia --project=. -e 'using Pkg; Pkg.test()' on this branch:

Test Summary: | Pass  Broken  Total     Time
QA/qa.jl      |   21       2     23  3m29.0s
     Testing ExponentialUtilities tests passed

The 2 broken are the pre-existing broken = true markers in the AllocCheck
testset, unchanged by this PR. Before the ignore was added the same run showed
the two new extension findings as errors, confirming the extension is genuinely
being scanned now and not silently skipped.

Because the extension source changed, GROUP=Core was also run:

Test Summary:      | Pass  Broken  Total     Time
Core/basictests.jl |  738       1    739  4m21.5s
     Testing ExponentialUtilities tests passed

Follow-up

The Base.get_extension skip quoted above is silent, so a future change that
breaks the extension's precompilation would leave QA green while extension
coverage fell back to zero. A guard asserting the extension module actually
exists is in #264; it was pushed shortly after this PR merged and is not
included here.

---

Please ignore this PR until it has been reviewed by @ChrisRackauckas.